Hacker News Reader

Comment by natex | Hacker News Reader

As it relies on P2P, watching a PeerTube video exposes your IP to anyone who wants it.

https://news.ycombinator.com/item?id=17387289

Can you explain why exposing your IP is a problem or security issue? What is the attack I am exposed to because someone knows my IP address?

What if the video on how to patch an extremely vulnerable router? I could be pretty sure that anyone watching that video was susceptible to this exploit at that time.

Violates expectations of privacy. Anyone can reconstruct your watch history.

What expectations of privacy should you have if you are directly contacting peers to retrieve data?

None, and that's the point. But a casual user clicking on a web link may not know that.

Exposures vary based on network config and other factors, but this study by the Office of the Privacy Commissioner of Canada talks about specific data acquired via IP address.

https://www.priv.gc.ca/en/opc-actions-and-decisions/research...

This is a illuminating read. I think the example drives it home.

--------- For example, the IP address of one individual Wikipedia contributor revealed that the person has:

1. Edited hundreds of pages on Wikipedia about television shows, both North American and international. The interest in TV shows was extensive and specific, but the details are not included here for privacy reasons;

2. Edited dozens of pages on Wikipedia related to history topics;

3. Participated in a discussion board about a television channel; and

4. Visited a site devoted to sexual preferences following an online search for a specific type of person.

Imagine if every false DMCA claim sent to a YouTuber meant $10,000 lawsuits for anyone who watched the video.

Probably because it's quite a personal thing, which can be used for port scanning, ddos, geolocation and other stuff. Also anyone can monitor p2p activity: https://iknowwhatyoudownload.com/en/peer/

Not that big of a problem if it's dynamic.

Does this apply to WebTorrent (WebRTC)? I'm not sure

It applies to torrenting in general, so I'd assume it also applies to WebTorrent

CGNAT also mixes up things somewhat.

for as long as that IP is pointing to your machine someone can perform analytics and scanning, subject you to manipulated packets and can track down your most recent activities as depicted by server caches, even spoofing a server you use often thus pwning you....

most people dont get this level of attention but you dont want it unless you like the thrill of cyberwar

It trades the privacy problem of trusting YouTube with your "data" with the problem of trusting the entire world with your "data"

Edit: kbutler explains the privacy issue below.

Original question: Wouldn’t you already have the IP of someone visiting your website?

The video is embedded on your own site, so you have all the info you need just from a regular page visit.

You would probably want to limit the number of people who can see it. It may be of interest to some groups to set-up peer servers to gain partial control and knowledge of the users and system

Client-server apps like YouTube reveal your IP to the server (Google).

Peer-to-peer apps reveal your IP to any other peer in the network (anyone seeding, anyone else downloading, and anyone who wants to monitor by pretending to be a downloader).

You are exposing your IP to Google when you visit Youtube.

I don't understand this argument. Google is a subset of everyone.

I think Google, as an entity, has a lot more power to collect a lot more data about everyone else in the world and do something with it than my neighbor sniffing my IP address when I visit a singular Peertube Instance.

I'd like to hear your counter argument on that.

Getting "doxxed" by someone on a social media platform can have much more impactful real-world consequences than Google showing you more relevant ads thanks to knowing that you watched a video titled "the most reliable power tools".

Well, when I use youtube I am giving Google permission to use my data in a way described in their TOS. If they break those terms, I have recourse (e.g. lawsuit, legislation, bad PR, etc.)

> do something with it than my neighbor sniffing my IP address when I visit a singular Peertube Instance.

You're minimizing the risk of Peertube from _anyone in the world_ seeing my IP address to "a neighbor" in order to make your argument. Anyway, using Peertube, there is no TOS, no recourse, no privacy.

> You're minimizing the risk of Peertube from _anyone in the world_ seeing my IP address to "a neighbor" in order to make your argument.

Use a VPN with Peertube if that is your concern. Problem solved.

> Anyway, using Peertube, there is no TOS, no recourse, no privacy.

Just the mere fact that most of your traffic goes thru Google for search, videos, Google Analytics everywhere on 99% of websites out of the Google realm, makes my privacy a lot less meaningful when I know a single company has access to all of that info and that precise company can leak that data to every government out there asking for it without letting me know.

By the way, has any individual sued Google for anything and won when it came to anything related to breach of privacy? Just the fact that it's extremely hard to prove that Google and nobody else leaked your information makes the possibility of legal action very remote to say the least.

> Use a VPN with Peertube if that is your concern. Problem solved.

No. Don't twist things. That's not my actual concern and doesn't solve the problem that: Peertube exposes your IP to anyone who wants it.

Don't you think people should know that? You responded with "whataboutgoogle?"

Sure, setting up/maintaining/buying a VPN may be a solution for some Peertube users, as has been said a million times in this thread.

> Don't you think people should know that?

PeerTube literally displays the warning when you start watching a video. How would people NOT know?

This is false dichotomy.

When using PeerTube you are exposing your IP address and the contents you are fetching or sharing with the whole world INCLUDING google.

They don’t just get your IP address... your neighbor can find out what video you are watching.

I understand google is going to know what video I watch, and accept that... but I don’t like the idea of everyone knowing what I watch.

OP is saying /anyone/, rather than just one very large corporation.

Are there any p2p services that don't do that? I thought you need a peer's IP when using any p2p service?

Any p2p system over an anonymity framework like Tor or I2P would meet that criteria.

Tor? Freenet? Maybe Peertube over Tor?

How is this implemented? Is there a feature in the browser that opens a TCP port to receive incoming connections? If so, how can I switch this off?

It uses WebRTC, which you disable in your browser. However, it's also used for in browser video calls.

I'm not too familiar with P2P technology but it seems that it's possible to set up vpn or onion routing between peers to avoid that.

If you computer is using a VPN will your private address be visible?

Reply on news.ycombinator.com